burp-cli

Thin CLI MITM proxy — HTTP forward + CONNECT tunnel + history + replay + jfind/v1 (v1.0)

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install burp-cli

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- burp-cli

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

burp-cli --help                # subcommand catalogue + flags
burp-cli --full                # extended help across every subcommand
burp-cli --about               # machine-readable attribution (JSON)
burp-cli --version             # version string

What it does

burp-cli is the explicit scope-down of a Burp-style proxy: NO GUI, NO scan engine, NO extension API — locked by the 2026-06-23 memory contract. v1.0 ships HTTP proxy (proxy-style + origin-form requests, forwarded upstream via reqwest::blocking), HTTPS CONNECT tunnel (pass-through, body NOT inspected — `connect-tunnel` kind in the log), NDJSON transaction log under $XDG_DATA_HOME/cli-johlem/burp-cli/transactions.jsonl (override with $BURP_CLI_DIR), history (list / show with truncated body preview), replay (re-send a recorded HTTP request), export (jfind/v1 records for classified transactions), and CA generation (self-signed root under ca/ — v1.1 will lift this into HTTPS MITM via a `--mitm` flag). Classification: data-exposure for token / private-key markers in response bodies (xoxb-, ghp_, AKIA, BEGIN RSA PRIVATE KEY, …), network-exposure for admin / kibana / grafana / actuator / swagger / graphql / .git / .env paths reachable. Pre-fills DORA Art. 9 + ISO/IEC 27001:2022 A.8.16 on every emission; data-exposure adds DORA 9(4)(c) + NIS2 21(2)(g) + A.8.24; network-exposure adds DORA Art. 11 + NIS2 21(2)(b) + A.8.21. MITRE T1552 / T1552.001 on data-exposure, T1595 on network-exposure. **Authorisation reminder:** sends real HTTP traffic — ALWAYS verify written authorisation before pointing a browser at it. 4 unit + 11 integration tests; zero warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.